Archive for the 'Law Enforcement' Category

Government pretexting

Not sure if anyone is reading posts anymore, but this was posted on slashdot. We already knew that government agencies have been buying our data from data brokers, but according to this article, some law enforcement agencies are buying things like phone records that are most likely obtained illegally through pretexting or other means.

IE7 Default Search Engine

As we discussed in class a month or so ago, the first Microsoft anti-trust case in the US involved Microsoft’s alleged unfair use of its operating system monopoly to push the use of Microsoft’s internet browser Internet Explorer. The second Microsoft anti-trust case was in the Europe Union and involved Microsoft’s alleged unfair use of its operating system monopoly to push its own brand of video player Microsoft Media Player. The EU forced Microsoft to offer a version of its operating system without the Microsoft player. They also fined Microsoft for its behavior, and that fine is currently under appeal.

I want to talk about the recent Google complaint that Microsoft is bundling its MSN search engine as the default search engine in the new version if Internet Explorer (IE7). Google complained :

“We don’t think it’s right for Microsoft to just set the default to MSN on install,” Marissa Mayer, vice president for search products and user experience at Google, said then.

This may start to sound like the previous two antitrust cases, but there are a few key differences. Google is complaining about the default setting in the internet browser, not the Windows operating system. While IE is the most popular browser, Microsoft does not have as strong a monopoly in the internet browser market as it does in the operating system market. Aside from pure market share, the burden to users switching browsers is much lower. This weakens the monopoly claims because users are not locked into just one browser.

The Department of Justice looked into the claims of unfairness with regards to the default search engine. Just recently the DOJ concluded that the default search engine is easy to change, so does not represent a problem.

The court document noted that personal computer makers are free to set the default search engine to any service they choose. …[the browser] included “a relatively straightforward method for the user to select a different search engine from the initial default.”

To me, this seems like the right decision. Google, however, is still unsatisfied and commented that if Microsoft wanted to make it easy for users to switch, they could have made the default search box configurable with just one click.

ClearPlay Filtering DVD Players

During the in-class discussion of the future of television, Professor Felten briefly mentioned the lawsuit brought against ClearPlay by the Directors Guild of America. ClearPlay enables certain DVD players to be customized with specific rating criteria (like nudity or violence levels) by the users so the playback of a DVD will skip or mute certain segments to conform to the rules setup by the users. The Directors Guild charged ClearPlay with copyright infringement for creating an unauthorized derivative work. I was looking for more details about the case and found it to be pretty interesting.

As I stated before, ClearPlay allows for users to setup their DVD player to filter certain content during the playback of the DVD. Users must purchase a DVD player with filtering capabilities (such as this one from amazon.com) and subscribe to ClearPlay to receive new filters. The information about how to filter each particular DVD can be obtained from ClearPlay (via various subscription models). They do a pretty good job of offering filtering for new releases and have a list of over 1900 movies. Once the specific filtering information is obtained by the DVD player, users can configure a filtering menu to specify the type of content that can and cannot be seen. There are four main categories: violence, sex and nudity, language, and other (which, for example, include certain types of drug use). Each category can also be further configured:

Under language, for instance, viewers can filter for six levels, including “vain reference to the deity” or “strong profanity.” [1]

I have never watched a ClearPlay filtered DVD, but here is a nice excerpt from a PC Magazine review :

Spiderman has, I’d say, one truly worrisome or suggestive scene for kids under 13. Mary Jane Watson is walking home alone in the rain when she’s accosted by a bunch of hooligans who, as the scene progresses, appear to want to rob or rape her. Spiderman arrives in the nick of time to save the day in pretty violent fashion. There’s punching, kicking, and more, but no blood. With the bad guys vanquished, Spiderman steals away into an alley. Mary follows him. She’s dripping wet. So wet in fact, that her top is virtually see-through. She and Spiderman engage in a steamy, prolonged kiss, and then he takes off.

Here’s how the same scene played out with the filter on. The guys still chase Mary, but the intensity of the scene is muted because it’s been cut down a bit. Spiderman arrives and beats the guys up, but this scene is also somewhat shorter, with some of the most bone-crunching blows removed—oddly, both versions did include Mary delivering a kick to the crotch to one of the attackers. The scene in the alley receives some serious tightening, and any glimpse of Mary’s see-through blouse has been excised.

The nice thing about all this is that you could never tell when the cuts were happening. There was no delay, no hiccup in playback. I would imagine that trying to maintain some semblance of continuity in a profanity-laced scene could prove more challenging.

This technology seems like a natural replacement for manually pausing or fast-forwarding through certain scenes that parents do not wish their children to view. The Directors Guild of America, however, does not believe that and in 2002 brought a lawsuit against ClearPlay. They claimed that the ClearPlay technology was creating an unauthorized derivative work of the content and this was in violation of copyright law.

“ClearPlay software edits movies to conform to ClearPlay’s vision of a movie instead of letting audiences see, and judge for themselves, what writers wrote, what actors said and what directors envisioned,” The Directors Guild of America said in a statement.

“Ultimately, it is a violation of law and just wrong to profit from selling software that changes the intent of movies you didn’t create and don’t own,” the statement said. [1]

The lawsuit was filed against ClearPlay and other companies that offer similar filtering and is still pending in U.S. District Court for Colorado. Here are the EFF links to the case documentation.

Since the case has been filed, new legislation has been enacted to specifically address some of these issues. Now this is where things get interesting. In 2005, Congress passed S. 167: The Family Entertainment and Copyright Act of 2005. The relevant section of this bill specifically enables technology that allows :

the making imperceptible, by or at the direction of a member of a private household, of limited portions of audio or video content of a motion picture, during a performance in or transmitted to that household for private home viewing, from an authorized copy of the motion picture

This bill specifically allows filtering technology such as ClearPlay. It is currently unclear if the lawsuit will continue given this new legislation. S.167 answers the question about this specific type of filtering technology, but did not give a conclusion of the scope of the derivative work restrictions on copyright.

One of the reasons, I believe, the lawsuit may still continue is CleanFlicks. I mentioned before that the lawsuit was brought against ClearPlay and other filtering companies; CleanFlicks is one of the others. The CleanFlicks model is to make a one-time filtering of the DVD content from an authorized (rental) copy and create a new DVD. This filtered DVD is then rented or sold to subscribers. The filtered content is not removed during playback, but rather permanently removed from the media. I don’t believe that this scenario is specifically allowed from S.167, so we are now back to the question of derivative work. I think it will be very interesting if this case continues through the courts.

Geo-location technologies

In class last week, we talked about the use of geo-location technologies with respect to directing emergency calls of someone using VoIP. A little looking into how these technologies are available and what they’re used for, and it seems that there are applications to many of the topics we’ve talked about this semester. When so much of the problem of internet governance stems from the anonymity of internet users and the ease with which internet traffic can transcend borders, knowing the location of an internet user changes the game.

First, let’s take a look at the geo-location technologies currently in use. A large part of the software used now is available from proprietary providers such as Quova and Digital Element. This proprietary software is based on determining the location of a particular IP address. This information has to be gathered by analyzing the locations of IP addresses all over the world. Note that while there are ways to conceal location (such as using a proxy server), the software can flag internet users who are doing so. Interestingly, another mechanism for determining physical geo-location without using IP addresses was patented in September, 2005. The patent holder: the NSA. The NSA website briefly profiles its “Network Geo-Location Technology” which as described here measures latency to build up a network latency topology map. This map can then be used to look up a computer based on the time it takes to connect to that computer. (This system can also be avoided using some kind of proxy service). The patent on this method of geo-location is one which the NSA has made available to be licensed for industry use.

Consider some of the possible uses for geo-location technologies (some taken from this article and the websites of Quova and Digital Element): Credit card companies or banks can use this software to detect fraud. Gaming operators can adopt this technology to comply with laws regarding trade practices over international and state borders. Sites such as eBay can use this to restrict which products are available in which locations (think Nazi paraphernalia and France). Hosts of digital worlds could keep track of the international transference of real money through in-game assets, and online providers of digital content can use it to comply with contracts that require them not to broadcast shows in certain areas (according to this article, major league baseball is a Quova customer that uses the product to make sure locally-broadcast games don’t lose their exclusivity by being unconditionally available online).

Aside from all of these applications for law enforcement, the companies that offer geo-location software market it for its ability to improve the user experience of the web. Namely, they cite the advantages of being able to give a user local search results, for example to guide a user to a store closest to them, and to target online advertising (ad-serving is currently the most common use of geo-location technology). Digital Element’s website claims that 25% of all Internet searches are local in nature, and that targeted ads have been shown to sell up to 30-40% more than general ads. Even if these numbers are exaggerated, it’s hard to argue that such location technologies have value to advertisers, search engines, and others.

The problem with geo-location technologies is that there’s a fine line between using general geographic data add desirable features or to make sure border-dependent laws are enforced on the web, and infringing on privacy and collecting personal information. Depending on the edition of Quova’s software, information obtained can be anywhere from simply geographic information in the basic edition up to much more in the security edition (“geographic information and confidence factors, demographic information, connection type, connection speed, IP routing type, AOL flag, ASN, carrier name, top-level domain, second-level domain, registering organization, a list of anonymizing proxies, hostnames, and routers”), and the services offered by Quova includes a variety of audit services for data collection (marketed as a means to help online business owners manage their business). We have to ask how much information should be available, and to whom.

While the current capabilities of both systems do raise questions about privacy and information availability, the question really comes up when we consider potential improvements on these technologies. While for marketing uses (among others) being able to locate some user / IP address to a general geographic area is sufficient, there are certainly other uses that would benefit from more exact geo-location technology such as emergency service for VoIP users, or the ability to more exactly locate someone committing fraud. The downside is that in different hands (or even in the hands of law enforcement officials depending on your point of view), the ability to accurately locate anyone using the internet is a dangerous tool, certainly one that you would not want to be commercially available. Using proxy servers may be an effective method of avoiding being located, it would also means the loss of all the positives of geo-locating technology.

The applications and benefits of geo-location technologies are quite substantial, and potentially provide a means to deal with many of the policy-related issues of internet regulation we’ve discussed this semester. As the technologies develop however, care needs to be taken with respect to the capabilities of such software available through general distribution.

National Security (should) Trump(s) Personal Privacy

This certainly isn’t a heated posting, but I am very bothered by the fact that some classmates are so dismal in their opinion about the surveillance operations being carried out by the National Security Agency (NSA).  I recall the point at which two students mentioned that even if there was verifiable proof that a large-scale terrorist attack had been averted, that they would still be unhappy about being wrongly monitored by the NSA.  The same people also mentioned that they had “serious issues” with appearing on surveillance footage of some recorder placed on a street corner.  To me, it seems that individuals who, to date, have not been threatened directly by some form of attack lack an appreciation for the protection mechanism that surveillance footage can serve as.  It is easy for us to sit in Robertson Hall and discuss how the NSA wiretapping is wrong, and how cameras on street corners are wrong because of privacy issues, but what is the real object we are trying to protect, our privacy or our lives, let’s be real.  Some official/employee contracted to look through suspect footage or listen to and analyze suspicious phone conversations is very unlikely to listen to the “smoochy-woochy” garble going on between anyone one of us and our boyfriend or girlfriend.  Put yourself in their position and imagine yourself stumbling onto a personal phone call/e-mail between two lovebirds or two sports fanatics.  In your quest to find important intelligence information, it would hardly be worth your time or of any interest for you to continue listening.  In light of the degradation of privacy, some people have called for an amendment to FISA to enable the government to be able to obtain warrants more quickly than they can now.  But even if this amendment does go through, the government will likely still surveil communications at a similar rate, and in doing so, FISA is doing little more than keeping a record of those being surveiled.  Does this all of a sudden make the surveillance less of a privacy concern to those who REALLY care?  No, of course not; these individuals are unlikely to feel more privatized while any form of eavesdropping is going on, and should just deal with the surveillance accordingly as it does decidedly more good than bad.

 

All of this is not to say that this system is completely exempt from having any vulnerabilities, it is simply to say that realistically, most people are not interested in your personal phone calls or clips of you scratching yourself on a street corner.  However, there are some concerns in my mind, many of which were brought up in class.  For example, word or phrase searching is likely a bad method for tracking terrorist activities since terrorists are now trying to employ the use of code words to cover their tracks.  And although I find it difficult to imagine that the NSA, with its magnanimous amount of funding and resources, is performing simple phrase comparisons on e-mails, it might be a better idea to analyze the traffic rather than the content.  This way instead of being fooled by tricky messages, they can become more familiar with the underlying communications network and possibly disrupt operations that way. 

 

And so while technically, the eavesdropping may or may not be soundly conducted, the practical implications it carries are immense and should be accepted.  What are the real policy issues associated with eavesdropping, privacy or longevity?  I think the distinction should be clear that living life should be more important to someone a small amount of privacy.

Is it the wiretaps or the lies?

Many people in class on Tuesday and in their posts since have been uneasy with the idea of all phone calls or even all international phone calls being screened by a computer. Others felt that the stakes were too high, and that national security comes before any uneasiness we may feel. While the case in favor of national security has its clear points, our pleas for privacy seem to come simply from a vague discomfort or a blind appeal to freedoms granted in the bill of rights. In order to weigh these conflicting interests it is necessary to get a clear picture of the specific freedoms we sacrifice in the face of this “blanket wiretapping.”

If we assume that the technology and the intelligence, in both information and cleverness, of the NSA is enough that these wiretaps do have the potential to discover and avert potential threats, the question becomes how much is this computer scan violating our privacy. To help figure this out, it makes sense to try to understand how a conventional wiretap does violates privacy. In a conventional wiretap, another human being, more importantly a government agent is listening to and making record of the contents of a person’s call. There seem to be many clear reasons why we need to protect the innocent from such invasions. In order for relationships and interactions to exist in any real way, there needs to be some assurance that we can say things to another person without anyone else knowing or hearing. There is something lost, even if we have no intention of breaking a law or discussing breaking a law, when we know a conversation is being overheard by another person. Yet, we must be sure not to assume that a computer eavesdropping will have the same effect. A computer lacks consciousness (for now), and lacks the ability to judge. More importantly as the system has been described, it lacks the ability to make a record in most cases. There should be no reason why a person would feel intruded upon by a computer searching for keywords in his or her conversation. Yet, for some reason, there is still some uneasiness.

If we imagine the government using conventional wiretaps across every citizen there are clear and justified fears. A government that has that much knowledge of its people’s desires, intentions and actions is on its way to if not already draconian. Yet this danger only arises when all the information is synthesized and all the records are kept. If the NSA’s filtering system is effective, then 99.999% of phone conversations might as well have never even been listened to, and furthermore of those that are listened to and recorded, surely 90% ought to involve discussions of a grave threat to the every citizen in the nation. These numbers may be generous, and perhaps if the system is not so effective there is a danger of a draconian government, but if they can develop a system that has effectiveness on this level, our fears will become unjustified.

Our immediate discomfort from hearing of these secret blanket wiretaps is very understandable. Anytime the government does something without our knowledge the usual assumption is that they must be doing something somehow wrong. If we describe the surveillance as “wiretapping the whole nation,” it’s clear that this is simply too much power. However, if we assume that the NSA has developed an efficient system, describing it as secret blanket wiretaps seems to be misleading. The problem seems to be, and it seems will remain, that we will never be comfortable with this kind of surveillance until we fully understand it. If the government were to come forward and reveal the details of an effective system, there should be no reason to speak out against it, even if we don’t fully respect the dangers it seeks to prevent; the fact is that an effective computer filter does not invade our privacy in the way that a wiretap does. But is it still safe if we just to assume?

The problem is that we cannot be sure to what degree the federal government is intruding into our lives, simply because they have worked so hard to keep it secret. Perhaps if the government had been upfront about the plan, we may have reacted too rashly, and perhaps they knew this. There’s also the chance that being upfront about the system would allow people to circumvent it and render it useless. However, these concerns are not compelling enough to grant the federal government a blind trust. We seem to have fallen into a catch-22.  If we assume the system to be as it has been described, we should have no real argument against it. But since it remains shrouded in secrecy, our fears of a draconian government remain justified and important. Thus we must fight to expose the system, despite the fact that it may be vital to national secret while still respectful of our rights, because we simply don’t know yet.

Firefox ad blocking plugin grows more advanced

Thanks to Mozilla Firefox extensions Adblock Plus and Filterset.G Updater, I surf an internet free of pop-ups, banner ads, flash ads, and even text-based Google ads. In 2004-2005, this type of software was a popular thing to cry foul about. Advertising giant DoubleClick warned “publishers would have to start charging for content.” Companies like Falk eSolutions produced anti-ad-blocker technologies in what seemed the start of an internet ad arms race. This post in the Spring 2005 COS 491 blog has an interesting discussion of whether browser ad blockers are contributory copyright infringers.

No legal battles ensued. This is particularly interesting because it’s been the most pivotal year in the software’s confusing history. When I downloaded the predecessor, Adblock, in Summer 2005, it would block images through filters the user defined manually. You could right-click on an image and click “Adblock” to block the image and (optionally) all images from that source. The ads would load, and only be hidden when the page was fully loaded. From a policy perspective, the significant thing about earlier versions of Adblock is what they didn’t do. They did not automate the advertisement filtering and blocking process, nor provide the users many ways to block ads without hand-picking. To benefit, a user had to be highly motivated to avoid ads, so people who used the extension arguably woudn’t respond to advertising anyway.

In the past year, the tool has become more sophisticated, offering:

(1) Compatibility with the Filterset.G Updater
This tool automatically updates a well-maintained set of filters and regular expressions every 4-7 days. Once a user has this installed along with Adblock Plus, few ads make it through. This “block by default” possibility has the potential to become a hot issue, since the ease of installation may tempt even the users responsive to ads. Few users like ads on the internet, and if the feature becomes popular enough it may seriously disrupt advertising revenue.

(2) Ads are blocked, not hidden
In the last few versions of the software, pages load without ever displaying the ads. Advertisers argue that this reduces consumer choice, since they don’t know what is being blocked. Technically that isn’t true - clicking the “Adblock” button in the corner of the browser generates a list of blocked elements - but it requires an active decision to view the ads.

(3) Whitelisting
This feature enables users to mark sites and domains on which they don’t want blocking. It’s convenient when a site has a lot of graphics, animations, and other “false positives” the plugin may pick up, or when a user actively wants to view ads. I think this actually makes the software more threatening to advertising revenue. One of the top complaints about Adblock was its tendency to block relevant site content. Now that this issue is fixed, the software is much more useful. It also weakens advertisers’ main argument, that software might over-zealously block ads against a user’s will.

(4) The “Support Website” Option
I discovered this interesting addendum while searching through the preferences just now:

The purpose of Adblock Ad Hiding is to allow you to support your favorite web site. By adding to your favorite site on the list below the adverts will be downloaded and detected by the site as having been viewed. Since sites, except those who only earn per click, earn revenue for the number of times the ads are viewed this will help them financially.

Interesting. It’s a minor feature in Adblock yet it points to one of the major flaws of the Pay-Per-View advertising model - that what’s detected as a “view” isn’t necessarily one. The move to pay-per-click is wise, but until all advertisers do this, features like this weaken advertisers’ “pity the poor web developer” arguments.

Another noteworthy change is that the Firefox web browser has grown in leaps and bounds the past year. The release of Firefox 1.5 in November coincided with the product gaining 10% of the browser market share. From personal experience, 1.5.0.3 has eliminated most of the bugs that plagued the 1.0 versions, creating a product that’s professinal-quality and better than IE by any sane standard. As more people use Firefox, more people will use Adblock, more people will realize they can view an ad-free internet, and chaos will descend upon the internet revenue structure - right? This pleads the question, should policymakers act?

I think the answer is something that can be applied to many of the legally questionable technologies we’ve discussed in class, and it has to do with scaleability. At what point does a technology become significant enough that it makes economic sense to go after it? No more than 10% of Firefox users use Adblock or some variant. So the loss of advertising revenue is negligible.

It is also hard to draw a legal boundary here, as ad blocking can also be accomplished, through customizing the HOSTS file. So outlawing all “ad blocking” would have too wide a scope. What about “all ad-blocking browser tools”? That would take us back to the age before built-in popup blockers, an idea I think causes universal cringing. I suppose forbidding “all ad-blocking browser tools that allow dynamic updating of filters” could work, but it would probably just increase Adblock adoption by giving it what it really lacks - publicity.

While this software may harm advertising revenue in theory, I think it represents a good opportunity for advertisers to re-evaluate their tactics, as they did successfully after blocking pop-up advertising became standard.